security watch reads zstd layers in CI by itself (R-1327): pinned zstandard 0.25.0 wheel, sha256-checked; RUNTIME log line; HA 2026.9.4 and RomM 5.4.1 dropped from the cache for the CI fill proof; Immich v3.3.5 power-cut repair evidence

scripts/test_security_watch.py

@@ -389,7 +389,11 @@ def t_runtime():
     check("W10 an UNCHECKED result is not cached (tomorrow tries again)", "sha256:f" not in cache, list(cache))
     src = open(os.path.join(HERE, "security_watch.py"), encoding="utf-8").read()
     check("W10 main() hands the reader to run() (off only with --no-runtime)",
-          "runtime=None if \"no-runtime\" in opts else cached_runtime_reader(rcache))" in src)
+          "rreader = None if \"no-runtime\" in opts else cached_runtime_reader(rcache)" in src
+          and "runtime=rreader)" in src)
+    check("W10 the reader counts what it read and from the cache (the log's RUNTIME line)",
+          r.stats["read"] == 2 and r.stats["cached"] == 1 and r.stats["not_checked"] == 1 and "RUNTIME read=" in src,
+          r.stats)
 
 
 def t_ghcr_pages():